Facilitator Notes & Model Answers — Lesson 16
For instructors and self-study · Model plan, horizon summary, and rationale
Model 30/60/90-day action plan
| Horizon | Model actions (owner + date on each) |
|---|---|
| 30 days — personal | Phishing-resistant auth on key accounts; device hardening baseline complete; verify-before-you-act rule written and in use; one OPSEC pass on your signature |
| 60 days — programme | Tabletop scheduled and run; one backup restored end-to-end; top-supplier access reviewed; acceptable-AI-use rule issued |
| 90 days — governance | Evidence-forcing question cadence set; metrics-that-matter agreed and vanity metrics retired; biggest unfunded resilience gap funded; post-quantum inventory of long-lived secrets begun |
Horizon-scan summary
- Now: harvest-now-decrypt-later — the quantum clock is already running for long-lived secrets.
- Near: AI-driven offence and deepfakes maturing; fundamentals (verification, OPSEC) still hold.
- Mid: IoT/OT and cyber-physical convergence extend cyber risk into the physical world.
- Ongoing: supply-chain systemic risk and tightening regulation with board-level accountability.
Why the poll answer is C (phishing-resistant auth + verification rule)
- A — read more intel: informs but changes nothing on its own.
- B — buy more tools: rarely addresses the human paths adversaries actually use.
- C — phishing-resistant auth + verify-before-you-act: together defeat credential theft and fraudulent instructions — the most common real intrusions — and require no one's permission.
- D — wait for the programme: surrenders your personal risk to someone else's timeline.
Teaching point: personal risk reduction this month is dominated by two do-it-yourself changes, not by tooling or reading.
Homework — what good looks like
Task 1
A strong plan is drawn from the participant's own felt gaps, has an owner and date on every item, keeps 30-day items self-owned, and includes at least one forward-looking (post-quantum / AI / convergence) 90-day item.
Task 2
A dated first action and a scheduled rehearsal with a named facilitator turn intent into commitments — the entire point of the course.